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Investigate the information in the headers of 
the image of an application 



If signature is supported natively in the OS, 
optionally search to determine if such 
application needs any custom loading action; if 
so, then do so. 



Loading the loader as pointed by the entry and 
call a well-defined entry point with the 
parameters user passed in 
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s Decompress or decrypt if necessary 
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Create the necessary sections for the target 
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s Create the initial thread and handover control ' 
to the initial thread 
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| Optionally, change some entry points in the 
j loaded program library so that in the j 
i subsequent loading operation by the initial 
i thread some particular custom action can be 

taken 
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Optionally, check some environment in the 
system to determine whether to load and 
^ execute the target program module 
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Pass control to the initial thread in the target 

image 



Intial thread load other modules, if necessary, 
and such modules may need custom action 



Set the hook to intercept calls 



Analyze if the loading module needs any 
custom action 
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